ansible: toolchain updates for RHEL machines

Pin `clang` to 19.
Add and pin `rust` 1.84 toolchain for Temporal.
Add `bindgen-cli` and `rustfmt` for V8 CI.

Author: richardlau

ansible/roles/baselayout/tasks/main.yml

@@ -111,6 +111,16 @@
     name: python3
     path: "/usr/bin/python3.8"
 
+- name: run os-specific steps after package install
+  include_tasks: "{{ post_include }}"
+  loop_control:
+    loop_var: post_include
+  with_first_found:
+    - files:
+        - "{{ role_path }}/tasks/partials/postinstall/{{ os }}.yml"
+        - "{{ role_path }}/tasks/partials/postinstall/{{ os|stripversion }}.yml"
+      skip: true
+
 - name: remove fortune from login shells
   when: os|stripversion == 'freebsd'
   lineinfile:

ansible/roles/baselayout/tasks/partials/postinstall/rhel.yml

@@ -0,0 +1,58 @@
+# Red Hat Enterprise Linux
+
+# Version lock packages to prevent them being updated. Unfortunately we cannot
+# lock a package before it is installed.
+# The generic "install packages" task in ansible/roles/baselayout/tasks/main.yml
+# doesn't allow downgrading, which means if a package is already installed at
+# a later version, specifying the version to install will not downgrade to that
+# version. So here we check the version and downgrade if necessary before
+# version locking to ensure we get what we want.
+
+- name: get installed clang version
+  ansible.builtin.command: clang -dumpversion
+  changed_when: false
+  register: clang_dumpversion_result
+
+- name: get installed rust version
+  ansible.builtin.command: rustc -vV
+  changed_when: false
+  register: rustc_vv_result
+
+# We don't need this. Get rid of it to simplify the number of packages to lock.
+- name: remove tracker-miners packages
+  ansible.builtin.dnf:
+    autoremove: true
+    name: tracker-miners
+    state: absent
+
+- name: downgrade packages
+  ansible.builtin.dnf:
+    allow_downgrade: true
+    name:
+      - llvm-toolset-{{rhel_llvm_version}}
+      - rust-toolset-{{rhel_rust_version}}
+    state: present
+  when: 'clang_dumpversion_result.rc != 0 or clang_dumpversion_result.stdout != rhel_llvm_version or
+    rustc_vv_result.rc != 0 or "release: " + rhel_rust_version not in rustc_vv_result.stdout_lines'
+
+# Lock dependent packages as well to prevent those being updated.
+- name: lock package versions
+  community.general.dnf_versionlock:
+    name:
+      - cargo-{{rhel_rust_version}}
+      - clang-{{rhel_llvm_version}}
+      - clang-libs-{{rhel_llvm_version}}
+      - clang-resource-filesystem-{{rhel_llvm_version}}
+      - compiler-rt-{{rhel_llvm_version}}
+      - libomp-{{rhel_llvm_version}}
+      - libomp-devel-{{rhel_llvm_version}}
+      - lld-{{rhel_llvm_version}}
+      - lld-libs-{{rhel_llvm_version}}
+      - llvm-{{rhel_llvm_version}}
+      - llvm-libs-{{rhel_llvm_version}}
+      - llvm-toolset-{{rhel_llvm_version}}
+      - rust-{{rhel_rust_version}}
+      - rust-std-static-{{rhel_rust_version}}
+      - rust-toolset-{{rhel_rust_version}}
+      - rustfmt-{{rhel_rust_version}}
+    state: present

ansible/roles/baselayout/vars/main.yml

@@ -7,6 +7,10 @@
 git_no_binpkg: [ ]
 git_version: 2.10.2
 
+# toolchain versions
+rhel_llvm_version: 19.1.7
+rhel_rust_version: 1.84.1
+
 ssh_config: /etc/ssh/sshd_config
 
 sshd_service_map: {
@@ -87,11 +91,11 @@ packages: {
   ],
 
   rhel8: [
-    'ccache,clang,cmake,gcc-c++,gcc-toolset-10,gcc-toolset-10-libatomic-devel,gcc-toolset-11,gcc-toolset-12,gcc-toolset-12-libatomic-devel,gcc-toolset-13,gcc-toolset-13-libatomic-devel,gcc-toolset-14-libatomic-devel,git,make,python3',
+    'ccache,cmake,gcc-c++,gcc-toolset-10,gcc-toolset-10-libatomic-devel,gcc-toolset-11,gcc-toolset-12,gcc-toolset-12-libatomic-devel,gcc-toolset-13,gcc-toolset-13-libatomic-devel,gcc-toolset-14-libatomic-devel,git,llvm-toolset-{{rhel_llvm_version}},make,python3,python3-dnf-plugin-versionlock,rust-toolset-{{rhel_rust_version}}',
   ],
 
   rhel9: [
-    'ccache,clang,cmake,gcc-c++,gcc-toolset-12,gcc-toolset-12-libatomic-devel,gcc-toolset-13,gcc-toolset-13-libatomic-devel,gcc-toolset-14-libatomic-devel,git,make,python3',
+    'ccache,cmake,gcc-c++,gcc-toolset-12,gcc-toolset-12-libatomic-devel,gcc-toolset-13,gcc-toolset-13-libatomic-devel,gcc-toolset-14-libatomic-devel,git,llvm-toolset-{{rhel_llvm_version}},make,python3,python3-dnf-plugin-versionlock,rust-toolset-{{rhel_rust_version}}',
   ],
 
   smartos: [

ansible/roles/build-test-v8/tasks/partials/rhel8-ppc64.yml

@@ -11,9 +11,10 @@
     state: enabled
 
 # V8 builds still require Python 2.
+# rhel_llvm_version and rhel_rust_version from ansible/roles/baselayout/vars/main.yml
 - name: install packages required to build V8
   ansible.builtin.dnf:
-    name: ['glib2-devel', 'llvm-toolset', 'ninja-build', 'python2', 'python2-pip']
+    name: ['glib2-devel', 'bindgen-cli', 'llvm-toolset-{{rhel_llvm_version}}', 'ninja-build', 'python2', 'python2-pip', 'rustfmt-{{rhel_rust_version}}']
     state: present
   notify: package updated
 

ansible/roles/build-test-v8/tasks/partials/rhel8-s390x.yml

@@ -11,9 +11,10 @@
     state: enabled
 
 # Older V8 builds still require Python 2.
+# rhel_llvm_version and rhel_rust_version from ansible/roles/baselayout/vars/main.yml
 - name: install packages required to build V8
   ansible.builtin.dnf:
-    name: ['GConf2-devel', 'llvm-toolset', 'ninja-build', 'python2', 'python2-pip']
+    name: ['GConf2-devel', 'bindgen-cli', 'llvm-toolset-{{rhel_llvm_version}}', 'ninja-build', 'python2', 'python2-pip', 'rustfmt-{{rhel_rust_version}}']
     state: present
   notify: package updated
 

ansible/roles/build-test-v8/tasks/partials/rhel8-x64.yml

@@ -11,9 +11,10 @@
     state: enabled
 
 # V8 builds still require Python 2.
+# rhel_llvm_version and rhel_rust_version from ansible/roles/baselayout/vars/main.yml
 - name: install packages required to build V8
   ansible.builtin.dnf:
-    name: ['llvm-toolset', 'ninja-build', 'python2', 'python2-pip']
+    name: ['bindgen-cli', 'llvm-toolset-{{rhel_llvm_version}}', 'ninja-build', 'python2', 'python2-pip', 'rustfmt-{{rhel_rust_version}}']
     state: present
   notify: package updated